Server should save the blinding factor along with the hash. (Maybe some sort of global blinding factor could work, and generate it deterministically?) Server

Server should save the blinding factor along with the hash. (Maybe some sort of global blinding factor could work, and generate it deterministically?) Server saves more data, but has the benefit that the rounds is computed in the client, so server's hash verification could be faster. (EDIT: To reduce rounds in server is probably not a good idea) I'm no nearly an expert in this stuff, so take it with a kilogram of salt.